8effc8fc676d4224ce4297a87e80b750e49a84c6867dc2c2df6e404b15659a96

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	MxM PREMIUM v5.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	MxM PREMIUM v5.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MxM PREMIUM v5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MxM PREMIUM v5.exe

Executes dropped EXE 1 IoCs

pid	Process
4880	rpc.exe

Loads dropped DLL 2 IoCs

pid	Process
5132	MxM PREMIUM v5.exe
5132	MxM PREMIUM v5.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
8	discord.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	MxM PREMIUM v5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	MxM PREMIUM v5.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/5132-4-0x000002A4BF1F0000-0x000002A4BF230000-memory.dmp	SmartAssembly

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c495-25.dat	upx
behavioral2/memory/4880-26-0x00007FF68C6E0000-0x00007FF68CEFE000-memory.dmp	upx
behavioral2/memory/4880-32-0x00007FF68C6E0000-0x00007FF68CEFE000-memory.dmp	upx
behavioral2/memory/4880-36-0x00007FF68C6E0000-0x00007FF68CEFE000-memory.dmp	upx

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/memory/5132-21-0x000002A4D95E0000-0x000002A4DA832000-memory.dmp	costura

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3336	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4340	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	MxM PREMIUM v5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	MxM PREMIUM v5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	MxM PREMIUM v5.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5132	MxM PREMIUM v5.exe
4880	rpc.exe
4880	rpc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5132	MxM PREMIUM v5.exe
Token: SeDebugPrivilege	4880	rpc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 4880	5132	MxM PREMIUM v5.exe	90
PID 4880 wrote to memory of 3336	4880	rpc.exe	91
PID 3336 wrote to memory of 4340	3336	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\MxM PREMIUM v5.exe
"C:\Users\Admin\AppData\Local\Temp\MxM PREMIUM v5.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Loads dropped DLL
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Windows\Temp\rpc.exe
  "C:\Windows\Temp\rpc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\system32\cmd.exe
    cmd /C C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion